icei99-sfej[.]top

This domain, icei99-sfej.top, is identified as a fake login phishing portal designed to harvest user credentials, likely targeting financial or corporate accounts. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure aligns with credential-harvesting campaigns. The domain exhibits characteristics of generic phishing, including obfuscated naming conventions and rapid deployment tactics. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 45.192.170.12, hosted under AS138995 (Antbox Networks Limited) in Hong Kong. It was registered on February 21, 2026, and is flagged by 10 out of 95 security vendors on VirusTotal. The domain appears on a single blocklist and is associated with an SSL certificate labeled R12. No Google Safe Browsing (GSB) entries were recorded at the time of analysis. The domain is currently offline, likely due to takedown actions or infrastructure rotation. Despite its inactive status, residual risk remains for users who may have interacted with the portal during its operational window. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication (MFA) to mitigate potential account takeovers. Network defenders should block the domain and associated IP at perimeter controls to prevent future access attempts.